Black-Box Security Test Tools CT-STE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security team is asked to assess a legacy on-premises application that exposes a proprietary binary protocol on TCP port 8443. The team has a two-day window and no access to source code or design documents. They need to identify protocol-level parsing flaws that could lead to memory corruption. Which tool category should they prioritize?

   • AA host-based vulnerability scanner running authenticated checks
   • BA port scanner to enumerate additional open services
   • CA network-based fuzzer that mutates protocol messages
   • DA web application scanner configured for HTTPS
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A QA engineer is testing a new REST API that accepts JSON payloads. They want to automate the discovery of injection flaws and schema-validation weaknesses in the API endpoints. The team has a CI/CD pipeline and needs a tool that can be integrated into the build process. Which approach best fits the requirement?

   • ARun a host vulnerability scanner against the API server OS
   • BRun an API-focused web application security scanner as a CI job
   • CManually craft JSON payloads in a REST client
   • DUse a network protocol fuzzer against the API's TLS port
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which of the following is a category of black-box security test tools?

   • ACompilers
   • BFuzzers
   • CDebuggers
   • DStatic code analyzers
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security team is assessing a web application that is behind a Web Application Firewall (WAF). The vulnerability scanner reports no findings. The team suspects the WAF is blocking the scanner's payloads. What is the most appropriate action?

   • AAccept the scanner results as accurate
   • BUse a network fuzzer instead
   • CConfigure the scanner to use evasion techniques or test from a whitelisted IP
   • DDisable the WAF permanently
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is a primary use case for vulnerability scanners in black-box testing?

   • ATo verify that all code is properly commented
   • BTo test the performance of the system under heavy load
   • CTo simulate a full manual penetration test without any human involvement
   • DTo identify known vulnerabilities in systems and applications
   Reveal Solution Discussion Select an answer first